Deployment Architecture

After adding a new index in indexes.conf, why is this index not being replicated in my Splunk 6.3.2 indexer cluster?

prianticoy
Explorer

Hi!!!

I have a big problem with the index replication in the Indexer cluster.

I add a new index in the indexes.conf file (splunk_home/etc/system/local). I did this in the master node, however, the index is not replicated into the peers (3 peers, repfactor=3)...

I already edit the indexes.conf in splunk_home/etc/system/master-apps/_cluster/local , and after that I restart the master node, but nothing works...

Do you have some tip for me?

Thanks!!!

1 Solution

renjith_nair
SplunkTrust
SplunkTrust

The process to add a new index to indexer cluster is

  1. Add the index details to $SPLUNK_HOME/etc/master-apps/_cluster/local/indexes.conf
  2. Make sure that repFactor=auto in included in the index stanza
  3. Distribute the new indexes.conf file to the peers by applying cluster bundle.

This will push the configuration to peers and indexes.conf in slave-apps directory of peers

http://docs.splunk.com/Documentation/Splunk/6.2.0/Indexer/Configurethepeerindexes
http://docs.splunk.com/Documentation/Splunk/6.2.1/Indexer/Updatepeerconfigurations#Distribute_the_co...

Happy Splunking!

View solution in original post

0 Karma

gavsdavs_GR
Path Finder

Out of interest, is the _cluster directory there for some special system reason ?

We distribute indexes.conf and parsing apps for the indexers by putting them in apps under master-apps and we've never done anything with the files under _cluster.

You recommend putting configs in _cluster (in here: http://docs.splunk.com/Documentation/Splunk/6.2.1/Indexer/Updatepeerconfigurations#Distribute_the_co...),

  • rather than appifying/containerizing all configs as per your normal best practice ?

It strikes me as something you (Splunk) are likely to update as you release new versions and add indexes (for example, _telemetry).

I'd call this a system directory, not a user manageable directory.

Soooo...I was just wondering why it's there.

renjith_nair
SplunkTrust
SplunkTrust

The process to add a new index to indexer cluster is

  1. Add the index details to $SPLUNK_HOME/etc/master-apps/_cluster/local/indexes.conf
  2. Make sure that repFactor=auto in included in the index stanza
  3. Distribute the new indexes.conf file to the peers by applying cluster bundle.

This will push the configuration to peers and indexes.conf in slave-apps directory of peers

http://docs.splunk.com/Documentation/Splunk/6.2.0/Indexer/Configurethepeerindexes
http://docs.splunk.com/Documentation/Splunk/6.2.1/Indexer/Updatepeerconfigurations#Distribute_the_co...

Happy Splunking!
0 Karma

prianticoy
Explorer

Hi! and thanks for your answer!

However, I already did that, and didn't work...

Do you know some other troubleshoot for this issue?

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

What's the status of cluster apply bundle command?
Check in your master's and indexer's log file to see if its throwing any errors for bundle distribution
Check in your indexer's slave-apps/_cluster/local or default directory if the indexes.conf has been updated

Happy Splunking!
0 Karma

prianticoy
Explorer

Hi, thanks for your time! I already configure the index and now replication is working fine.

Thanks!

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Just out of curiosity, what was the problem ?

Happy Splunking!
0 Karma

prianticoy
Explorer

I already distributed the config trouhg the master node...

Do you have some tip? please!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...